afcuuxxccuxx.changeip.us
Open in
urlscan Pro
210.16.121.77
Malicious Activity!
Public Scan
Submission: On October 05 via automatic, source openphish — Scanned from US
Summary
TLS certificate: Issued by R3 on October 4th 2022. Valid for: 3 months.
This is the only time afcuuxxccuxx.changeip.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: America First Credit Union (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 210.16.121.77 210.16.121.77 | 7489 (HOSTUS-GL...) (HOSTUS-GLOBAL-AS HostUS) | |
1 | 216.51.43.116 216.51.43.116 | 17150 (AFCU) (AFCU) | |
1 | 206.81.136.154 206.81.136.154 | 17150 (AFCU) (AFCU) | |
1 | 184.50.216.48 184.50.216.48 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 2600:141b:900... 2600:141b:9000::b857:ad3b | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2600:141b:900... 2600:141b:9000::b857:ad19 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
7 | 7 |
ASN16625 (AKAMAI-AS, US)
PTR: a184-50-216-48.deploy.static.akamaitechnologies.com
public.cobrowse.oraclecloud.com |
ASN20940 (AKAMAI-ASN1, NL)
ds-aksb-a.akamaihd.net |
ASN20940 (AKAMAI-ASN1, NL)
i26847600-ds-aksb-a.akamaihd.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
akamaihd.net
ds-aksb-a.akamaihd.net — Cisco Umbrella Rank: 6993 i26847600-ds-aksb-a.akamaihd.net |
6 KB |
2 |
americafirst.com
secure.americafirst.com — Cisco Umbrella Rank: 403006 www.americafirst.com — Cisco Umbrella Rank: 412996 |
64 KB |
2 |
changeip.us
1 redirects
afcuuxxccuxx.changeip.us |
9 KB |
1 |
oraclecloud.com
public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 19756 |
12 KB |
7 | 4 |
Domain | Requested by | |
---|---|---|
2 | ds-aksb-a.akamaihd.net |
public.cobrowse.oraclecloud.com
ds-aksb-a.akamaihd.net |
2 | afcuuxxccuxx.changeip.us | 1 redirects |
1 | i26847600-ds-aksb-a.akamaihd.net |
afcuuxxccuxx.changeip.us
|
1 | public.cobrowse.oraclecloud.com |
afcuuxxccuxx.changeip.us
|
1 | www.americafirst.com |
afcuuxxccuxx.changeip.us
|
1 | secure.americafirst.com |
afcuuxxccuxx.changeip.us
|
7 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
webaccess45.americafirst.com |
www.americafirst.com |
portal.hud.gov |
www.ncua.gov |
Subject Issuer | Validity | Valid | |
---|---|---|---|
afcuuxxccuxx.changeip.us R3 |
2022-10-04 - 2023-01-02 |
3 months | crt.sh |
secure.americafirst.com Sectigo RSA Organization Validation Secure Server CA |
2022-09-26 - 2023-09-26 |
a year | crt.sh |
www.americafirst.com Sectigo RSA Extended Validation Secure Server CA |
2022-01-27 - 2023-01-27 |
a year | crt.sh |
*.cobrowse.oraclecloud.com DigiCert SHA2 Secure Server CA |
2021-11-06 - 2022-11-08 |
a year | crt.sh |
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-28 - 2023-06-30 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://afcuuxxccuxx.changeip.us/Afcu22/
Frame ID: 34679C0FAFA8B9072DDB500143519A13
Requests: 5 HTTP requests in this frame
Frame:
https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=iygc1h43ow&version=20190514
Frame ID: 9D1092C474762419AEB15C4B1423E5F0
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://afcuuxxccuxx.changeip.us/Afcu22
HTTP 301
https://afcuuxxccuxx.changeip.us/Afcu22/ Page URL
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title: Enroll now
Search URL Search Domain Scan URL
Title: Forgot user ID
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: terms
Search URL Search Domain Scan URL
Title: branch locator
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Email Opt Out Procedure
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://afcuuxxccuxx.changeip.us/Afcu22
HTTP 301
https://afcuuxxccuxx.changeip.us/Afcu22/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
afcuuxxccuxx.changeip.us/Afcu22/ Redirect Chain
|
22 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-desktop-inverse.a3a99f3a.png
secure.americafirst.com/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eagle-inverse.png
www.americafirst.com/content/dam/general/ |
54 KB 55 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ll_storage_html5.html
public.cobrowse.oraclecloud.com/rely/storage/ Frame 9D10 |
44 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aksb.min.js
ds-aksb-a.akamaihd.net/ Frame 9D10 |
13 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
RRT
ds-aksb-a.akamaihd.net/ Frame 9D10 |
0 402 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b
i26847600-ds-aksb-a.akamaihd.net/2/407454/ Frame 9D10 |
0 269 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: America First Credit Union (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
afcuuxxccuxx.changeip.us
ds-aksb-a.akamaihd.net
i26847600-ds-aksb-a.akamaihd.net
public.cobrowse.oraclecloud.com
secure.americafirst.com
www.americafirst.com
184.50.216.48
206.81.136.154
210.16.121.77
216.51.43.116
2600:141b:9000::b857:ad19
2600:141b:9000::b857:ad3b
38c3a1e6e7c084de1e03bc236437a0cfc3784d06e02c27c1432cd9df116aedcc
4c2f9e3884701acbb2bcb1d909abb00fb7f336644ca3b295ad3bb9fd192bf6b8
6dca5560a8f469e2ad6fc4614f526be2392a40aee2586b207891a729d03b0d39
7f06def529e0076b37f65c60085a6b1c65f1bbab0b1f87c72c188018b5094966
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855